From: gopher-bounce@complete.org
       Date: Sun May 10 04:43:50 2009
       Subject: [gopher] Re: Running buckd in a chroot jail?
       
       OK, here's take two, using jailkit (http://olivier.sessink.nl/jailkit):
       
       # added by Bucktooth install
       service buckd
       {
               type                    = UNLISTED
               protocol                = tcp
               port                    = 70
               flags                   = REUSE
               socket_type             = stream
               wait                    = no
               instances               = UNLIMITED
               user                    = root
               server                  = /usr/sbin/jk_chrootlaunch
               server_args             = -j /chroot/buckd -x /chroot/buckd/usr/local/bin/buckd --user gopher --group gopher
       }
       
       Does anybody see any glaring security issues with this?  buckd does
       indeed seem to be running under user "gopher" when port 70 is
       accessed:
       
       gopher   23883  0.0  0.8  82332  2340 ?        Ss   02:40   0:00 /usr/bin/perl -s usr/local/bin/buckd
       
         --Brian
       
       On Sat, May 09, 2009 at 08:05:03PM -0500, Brian Koontz wrote:
       > I've got buckd successfully running in a chroot jail.  This is the
       > relevant portion of my xinetd.conf file:
       > 
       > # added by Bucktooth install
       > service buckd
       > {
       >         type                    = UNLISTED
       >         protocol                = tcp
       >         port                    = 70
       >         flags                   = REUSE
       >         socket_type             = stream
       >         wait                    = no
       >         instances               = UNLIMITED
       >         user                    = root
       > #        server                  = /chroot/buckd/usr/local/bin/buckd
       >         server                  = /usr/sbin/chroot
       >         server_args             = /chroot/buckd/ /usr/local/bin/buckd
       > 
       > }
       > 
       > The obvious problem here is that buckd is running as root (because
       > chroot must be invoked as root).  From what I understand, it's still
       > possible to break out of a chroot jail as root.  Is there a way for me
       > to set this up so buckd runs under a non-root user?
       > 
       >   --Brian
       > 
       Thread start
 (DIR) [gopher] Running buckd in a chroot jail?
       Thread start
 (DIR) [gopher] Running buckd in a chroot jail?
 (DIR) Followup: [gopher] Re: Running buckd in a chroot jail?
 (DIR) Followup: [gopher] Re: Running buckd in a chroot jail?